Axios Compromised on NPM – Malicious Versions Drop Remote Access Trojan

Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by dspillett on Tuesday March 31, 2026 @10:03AM (#47587565)

Probably went with the simplest implementation, if starting from the current “seconds since epoch” value. Let the user do any calculations needed to translate three days into that measurement.

It also efficiently annoys the most people at once: those what want hours will complain if they set it to days, thought that want days will complain if hours are used. By using minutes or seconds you can wind up both segments while not offend those who rightly don't care because they can cope with a little arithmetic :)

Though doing what sleep(1) does would be my preference: default to seconds but allow m/h/d to be added to change that.

[ Parent | on HN ]

Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by Xirdus on Tuesday March 31, 2026 @10:13AM (#47587701)

I'm old enough to remember computers being pitched as devices that can do tedious math for us. Now we have to do tedious math for them apparently.

[ Parent | on HN ]

Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by dspillett on Tuesday March 31, 2026 @10:22AM (#47587811)

Hence the way I would do it (and have for other purposes), as stated in my final sentence. Have the human state the intent and convert to your own internally preferred units as needed.

[ Parent | on HN ]

Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by darepublic on Tuesday March 31, 2026 @11:00AM (#47588329)

I'm sure you would like to memorize all kinds of API instead of having something idiot proof and straightforward

[ Parent | on HN ]

Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by Xirdus on Tuesday March 31, 2026 @02:59PM (#47591902)

As if `minimumReleaseAge` in `[install]` section of `.bunfig.toml` doesn't require the same kind of memorization.

[ Parent | on HN ]

Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by moralestapia on Tuesday March 31, 2026 @11:33AM (#47588890)

Hey that's a great joke, you made me spill my morning home-brewed kombucha.

I'm going to steal that one for my JavaScript monthly developers meetup.

Is it ok if I attribute it to "Xirdus on Hacker News"?

[ Parent | on HN ]

Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by Xirdus on Tuesday March 31, 2026 @02:57PM (#47591866)

Lol sure.

[ Parent | on HN ]

Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by OJFord on Tuesday March 31, 2026 @04:05PM (#47592730)

No no no, see now we just say "computer! do tedious math!", and it will do some slightly different math for us and compliment us on having asked it to do so.

[ Parent | on HN ]

Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by fc417fc802 on Tuesday March 31, 2026 @10:40AM (#47588046)

The one true unit of time is hexadecimal encoded nanoseconds since the unix epoch. (I'm only half joking because I actually have authored code that used that before.)

[ Parent | on HN ]